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Abstract 

Automation in the aviation domain has been increasing for the past two decades. Pilot 
reaction to automation varies from highly favorable to highly critical depending on both 
the pilot’s background and how effectively the automation is implemented. We describe a 
user-centered approach for automation that considers the pilot’s tasks and his needs 
related to accomplishing those tasks. Further, we augment rather than replace how the 
pilot currently fulfills his goals, relying on redundant displays that offer the pilot an 
opportunity to build trust in the automation. Our prototype system automates the 
interpretation of hydraulic system faults of the UH-60 helicopter. We describe the 
problem with the current system and our methodology for resolving it. 

Introduction 

Modern aircraft feature a variety of automation technologies to help the pilot with 
such things as checklist execution, navigation, descent planning, engine configuration, 
and system monitoring. Older aircraft can be retrofitted to incorporate many of these 
features by replacing older radios with modern units, replacing traditional gauges with 
computer monitors, and linking everything with computer processors. One of the goals of 
automation is to improve the pilot’s situational awareness. A related goal is to decrease 
the workload required to maintain a given level of awareness. Technologies assist the 
pilot with awareness of position, terrain, traffic, fuel usage and remaining aircraft range, 
engine operating characteristics, etc. 

Pilots have various reactions to automation. They may find it superfluous (the 
“real pilots don’t need an autopilot” perspective), helpful (“the autopilot can fly an 
approach much more accurately than I; a real plus in bad weather” perspective), or 
confusing (the “what’s it doing now?” perspective). We believe that to make automation 
helpful, it needs to fulfill a pilot’s need, fit seamlessly into the flying tasks, and be easy 
enough to understand to earn a pilot’s trust. Using this user-centered approach, we 
developed a system to assist a helicopter pilot in the task of recognizing and properly 
reacting to hydraulic system failures. It eases the pilot’s task by quickly interpreting the 
same signals he uses to identify a failure and by explicitly providing not just the type of 
failure but also the desired emergency procedures and any flight limitations. The 
traditional display of the failure remains available to the pilot; this redundant display of 
information enables him to use just the parts of the new display he chooses or to verify 
the automation’s result and build trust of it gradually. 

In the following sections, we define situational awareness and provide an 
overview of measurement factors, describe the system and the problem with that system 
that we are addressing, present our methodology for solving the problem and evaluating 
our solution, and conclude with areas of related future work. 
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Situational Awareness 

Situational awareness (SA) can be hierarchically decomposed into three levels. To 
achieve the initial level of SA requires that the pilot perceives relevant environmental 
information (e.g., state of a subsystem, existence of terrain, presence of traffic, etc.). The 
next higher level requires that he be able to integrate the lower level information and 
understand how it affects his current task. The ultimate highest-level SA requires the pilot 
use that understanding to direct further perception and anticipate future events. 1 As an 
example, a pilot with level 1 SA notices the fuel level in the selected tank is low; a pilot 
with level 2 SA understands that the rate of fuel usage is higher than expected and he 
must switch to a tank with more fuel; and a level 3 SA pilot determines that he is unlikely 
to reach his destination due to the unexpected rate of fuel usage and must divert to an 
alternate airport prior to engine failure. 

Workload to accomplish the various levels of SA can be measured by a number of 
factors including physical demand, mental demand, time pressure, effort expended, 
performance level achieved, frustration experienced, and annoyance experienced. 

Through our work, we aim to decrease mental demand, decrease effort expended, and 
increase the performance level achieved by the pilot in interpreting the state of a Sikorsky 
UH-60 subsystem and recalling the effects of any failures. 

The System 

The Sikorsky UH-60 Black Hawk, shown in Figure 1, is the primary troop 
transport in the U.S. Army. Variants of the UH-60 are used by the U.S. Air Force (Pave 
Hawk), U.S. Navy and Coast Guard (Seahawk), rescue and firefighting organizations 
(Firehawk), and international customers. The Black Hawk is designed for crew 
survivability and its engines, rotors, and transmission are highly capable of taking 
damage. Either of its twin turbine engines can keep the helicopter airborne if the other 
fails, the flight controls are ballistically hardened, the fuel system is crash resistant and 
self-sealing, and it has widely-separated redundant electronic and hydraulic systems. In 
this work, we focus on the hydraulic system. 



Figure 1: Sikorsky UH-60 helicopter 

The hydraulic system provides hydraulic pressure to operate the primary servos, 
tail rotor servos, pilot assist servos, and APU start motor. There are three redundant 
hydraulic systems: the number 1 or first stage, the number 2 or second stage, and the 
backup. The major components shared by these three systems (shown in Figure 4) include 
three hydraulic pump modules, two transfer modules, a utility module, a pilot-assist 
module, three primary servos, a tail rotor servo, four pilot-assist servos, an APU 
accumulator, an APU handpump, and a refill handpump. A leak detection and isolation 
(LDI) feature is built into the hydraulic system using pressure switches on the pump 
modules, check valves and shutoff valves in the transfer modules, and electronic logic 
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modules. When a pressure switch senses a pressure loss in the system, the logic module 
will shut off appropriate valves to isolate the leak and automatically turn on the backup 
pump. 

The Problem 

Two related mechanisms assist the Blackhawk pilot in determining the status of 
the hydraulic system: the leak detection and isolation (LDI) subsystem assists pilots in 
determining the location of a fluid leakage, and pressure and level sensors inform the 
pilot of other types of failures. Each anomalous condition results in one or more 
advisories appearing on the caution and advisory panel, shown in Figure 2. 



Figure 2: Caution/Advisory Panel showing end-state for leak in the #2 primary servos. 

The panel has 82 unique messages, such as “#1 fuel low” or “back-up rsvr low.” 
Fifteen of these messages are specific to the hydraulic subsystem and encode 23 
anomalies. The end-state for an anomaly can be encoded by as few as one message or as 
many as nine with an average of five; intermediate states can have as many as thirteen 
messages turn on and off prior to reaching the end-state. A centrally-located master 
warning light alerts the pilot of the appearance of a message on the panel; the pilot must 
then infer the problem based on the displayed caution and advisory messages. This 
inference relies on extensive training and on what Don Norman refers to as knowledge in 
the head. 2 Although straightforward in the single-message anomaly situation, in stressful 
situations, such as those caused by mission-altering anomalies, the pilot’s workload is 
increased by the demands of determining the problem and remembering the associated 
emergency procedures and operating limitations. 


3 




The Methodology 

Our approach to resolving the problem of relying on knowledge in the head is to 
transfer the knowledge into the world. Specifically, we explicitly provide the pilot with a 
description of the problem, the associated emergency procedures, and a reminder of any 
operating limitations. 

Anomalous situations can be detected by examining both the state of all sensors 
and the outputs of the LDI subsystem. Alternatively, they can be detected by observing 
the processed values sent to the caution and advisory panel. We utilize the second 
approach. Using these signals and the knowledge that the set of messages associated with 
each problem is deterministic, an anomaly can be interpreted via a state transition 
diagram. The states represent the hypothesis about the anomaly as described by the 
signals already observed and the signals are used to transition from one hypothesis to a 
more fitting one. The pilot is informed upon entering a state that describes a known 
anomaly. If further signals are received (that is, further messages are displayed on the 
panel), the description given to the pilot is updated to reflect the additional knowledge. 

In addition to presenting the pilot with a description of the anomalous situation, 
our system also presents a list of associated emergency procedures and corresponding 
operating limitations. Figure 3 shows the display of detected problem, suggested actions, 
and limitations. The pilot can scroll back through the “detected problem” segment to 
recall previous problems. Moreover, rather than displaying operating limitations that 
consider only the most recent problem, new limitations can be combined with previous 
limitations to further decrease the pilot’s workload in determining the desired reaction. 


Detected Problem, Suggested Actions. & Limitations 


Detected Problems 

Partial loss of hyd fluid in #2 system. 
...Leak in pilot assist module. 

...Leak upstream of #2 transfer module. 
. . .Leak in #2 primary servos . 
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Emergency Procedures 

SERVO OFF switch - 2nd STG. 
LAND AS SOON AS POSSIBLE. 


Operating Limitations 

Max A/S with two HYD system inop: 150 KIAS. 

Max A/S with two HYD system mop in IMG: 140 KIAS. 

Max angle of bank: 30 deg. 


Figure 3: Display of problem description, emergency procedures, and operating limitations. 
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Evaluation 

In order to test our approach, we simulated the hydraulic system from the 
perspective of the pilot. Using the graphical interface shown in Figure 4, we can inject 
failures and evaluate the response. 



Figure 4: Simulator for UH-60 Hydraulic System. 

Pressure switch detectable failures are simulated by the various pull-down 
pressure menus. The backup pump module has the options of “ok” or “failed” while the 
rest of the modules have the options of “ok” or “low.” Multiple pumps can be failed 
simultaneously to simulate dual or triple pump failure scenarios. Alternately, LDI 
detectable failures are controlled by the “leak size” sliders with the slider positioned on 
the far left for no leak, far right for a large leak, and at intermediate positions for a 
comparatively smaller leak. If a leak is detected, the LDI turns off valves in a predefined 
order and checks the effect on continued pressure loss. Thus, from the LDI perspective, 
the size of the leak affects how quickly it is able to isolate the leak to its true location. As 
the LDI turns various valves and the backup pump off or on, corresponding messages 
appear on the caution/advisory panel. Thus, from a pilot’s perspective, the size of the leak 
affects how quickly messages appear and disappear. Our simulator imitates the timing 
behavior and is a fair reproduction of what a pilot sees in the actual helicopter. 

The hypothesis of our work is that we can improve a Black Hawk pilot’s 
situational awareness by automatically determining a hydraulic system failure given the 
sequence of messages on the caution/advisory panel and then explicitly displaying 
necessary information about emergency procedures and operating limitations. Via our 
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simulator, we are able to demonstrate the accurate performance of the interpretation and 
instantaneous display. 

Empirical evaluation of the degree of improvement to the pilot’s situational 
awareness requires either access to panel messages from a high fidelity Black Hawk 
simulator or hardware propagation of the message signals as input to our interpretation 
algorithm. A joint NASA and Army rotorcraft research program has available a modified 
UH-60 known as RASCAL, Rotorcraft Aircrew Systems Concepts Airborne Laboratory. 
RASCAL is highly instrumented and serves as a platform to test alternative displays to 
improve the pilot’s interface to the helicopter systems. Previous studies have accessed 
panel messages dealing with the transmission system in order to demonstrate automated 
diagnosis of transmission problems. 3 Upon establishing access to hydraulic system 
messages, we will conduct comparison studies to evaluate both the degree of SA 
improvement and the degree of workload reduction. The results of these studies will be 
published in a subsequent paper. 


Conclusions 

It has been demonstrated in various fields that productivity can be greatly 
enhanced through the use of automation technologies. In order to be fully accepted in 
aviation, automation not only needs to increase productivity but do so cooperatively with 
the pilot. That is, the pilot must know what the automation is currently doing and what it 
will do in the future. Although the Llight Management System (LMS) has been a feature 
of commercial airliners for decades, it is still not unusual to hear conversations where one 
pilot is asking the other “What’s it doing?” 4 or confessing to the air traffic controller that 
“We’re just as surprised as you were to see the computer turn us that way.” 5 To avoid this 
situation, our approach to automation focuses on the user’s needs for both performance 
and awareness. Rather than replacing what the pilot currently does, we augment his 
capabilities with displays that back up his internal knowledge. In other work, we 
incorporate intelligence that eliminates the need for the pilot to perform tedious 
computations and visualize the results in ways that the pilot can instantly and 
continuously determine the results of the computation and their effects on his flight. 6 
Pilot evaluations will determine whether this approach produces effective decision 
support systems or continues to lead to what has been described as “clumsy automation.” 7 
In future work, we will explore incorporating other awareness and decision support 
systems, and presenting aircraft system status via additional modalities such as 
sonification and tactile methods. 
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